From 075785a94ab7c48dc75ad50b4c41204168d76f1c Mon Sep 17 00:00:00 2001
From: Jonathan Davies <jpds@protonmail.com>
Date: Wed, 14 Jul 2021 22:30:37 +0100
Subject: [PATCH] virt: Defined a virt_common_runtime_t type for the new
common/system.token file and added permissions to virtd_t and virtlogd_t.
Modelled on: https://github.com/fedora-selinux/selinux-policy/commit/1f761d0bbdc08d21a91cdcbd1909ddb53858e354
libvirt change introducing this: https://gitlab.com/libvirt/libvirt/-/commit/cbfebfc74741a00bddf67b7fa10892b757fffd6a
Signed-off-by: Jonathan Davies <jpds@protonmail.com>
---
policy/modules/services/virt.fc | 1 +
policy/modules/services/virt.te | 11 +++++++++++
2 files changed, 12 insertions(+)
diff --git a/policy/modules/services/virt.fc b/policy/modules/services/virt.fc
index 5266b68c1..ab5d0885d 100644
--- a/policy/modules/services/virt.fc
+++ b/policy/modules/services/virt.fc
@@ -58,6 +58,7 @@ HOME_DIR/VirtualMachines/isos(/.*)? gen_context(system_u:object_r:virt_content_t
/run/libguestfs(/.*)? gen_context(system_u:object_r:virt_runtime_t,s0)
/run/libvirtd\.pid -- gen_context(system_u:object_r:virt_runtime_t,s0)
/run/libvirt(/.*)? gen_context(system_u:object_r:virt_runtime_t,s0)
+/run/libvirt/common(/.*)? gen_context(system_u:object_r:virt_common_runtime_t,s0)
/run/libvirt/lxc(/.*)? gen_context(system_u:object_r:virtd_lxc_runtime_t,s0)
/run/libvirt-sandbox(/.*)? gen_context(system_u:object_r:virtd_lxc_runtime_t,s0)
/run/libvirt/qemu(/.*)? gen_context(system_u:object_r:svirt_runtime_t,s0-mls_systemhigh)
diff --git a/policy/modules/services/virt.te b/policy/modules/services/virt.te
index 256ea584d..5e444ecf7 100644
--- a/policy/modules/services/virt.te
+++ b/policy/modules/services/virt.te
@@ -129,6 +129,9 @@ type virt_image_t; # customizable
virt_image(virt_image_t)
files_mountpoint(virt_image_t)
+type virt_common_runtime_t;
+files_runtime_file(virt_common_runtime_t)
+
type virt_content_t; # customizable
virt_image(virt_content_t)
userdom_user_home_content(virt_content_t)
@@ -577,6 +580,11 @@ manage_files_pattern(virtd_t, virt_runtime_t, virt_runtime_t)
manage_sock_files_pattern(virtd_t, virt_runtime_t, virt_runtime_t)
files_runtime_filetrans(virtd_t, virt_runtime_t, { file dir })
+allow virtd_t virt_common_runtime_t:file append_file_perms;
+manage_dirs_pattern(virtd_t, virt_common_runtime_t, virt_common_runtime_t)
+manage_files_pattern(virtd_t, virt_common_runtime_t, virt_common_runtime_t)
+filetrans_pattern(virtd_t, virt_runtime_t, virt_common_runtime_t, dir, "common")
+
manage_dirs_pattern(virtd_t, virtd_lxc_runtime_t, virtd_lxc_runtime_t)
manage_files_pattern(virtd_t, virtd_lxc_runtime_t, virtd_lxc_runtime_t)
filetrans_pattern(virtd_t, virt_runtime_t, virtd_lxc_runtime_t, dir, "lxc")
@@ -1367,6 +1375,9 @@ manage_sock_files_pattern(virtlogd_t, virt_runtime_t, virtlogd_run_t)
filetrans_pattern(virtlogd_t, virt_runtime_t, virtlogd_run_t, sock_file)
files_runtime_filetrans(virtlogd_t, virtlogd_run_t, file)
+allow virtlogd_t virt_common_runtime_t:file append_file_perms;
+manage_files_pattern(virtlogd_t, virt_runtime_t, virt_common_runtime_t)
+
kernel_read_system_state(virtlogd_t)
files_read_etc_files(virtlogd_t)